event add
event unsafe_contains
event remove

ftltl : [](add implies (! unsafe_contains U remove))
